CVE-2026-66401EPSS p9.0%

CVE-2026-66401CVE-2026-66401

freerdp / freerdp

Description

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

Scoring

CVSS 2.1 ()
VectorCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS0.20% probability of exploitation · percentile 9.0% · 2026-10-05T12:00:23Z
Last modified2026-09-03
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.